The explosion in web-based services has led to an increased need for security, especially in financial transactions. An interaction between a vendor and a financial institution across a network offers opportunities for malicious interference from hackers, such as ‘spoofing’ or outright identity theft, as examples.
When a user purchases a product from a vendor, the user sends sensitive financial information to the vendor. The vendor then validates the financial information with the financial institution and accepts the user's order, as an example. During this transaction, the user's financial information may be transmitted through several network links. Hackers may intercept this information, or a hacker may assume an involved entity's identity and either misappropriate the information or attempt to enter some of the other involved entity's sites. These are just examples of some problems that may occur during a transaction with which most users would be familiar, but demonstrate the problems inherent in such a transaction.
Typically, however, there are many transactions or transfers of information that may occur across the Internet or similar networks that do not involve consumers' information directly. Financial institutions may transfer information back and forth, producers and their suppliers may transfer order information, purchase order specifics, etc. All of these transactions need to be secure, or these entities become vulnerable to attack.
In addition to the growing number of transactions involving confidential information, there is a movement towards interoperability. Currently, there are several different kinds of devices that use the Internet to communicate. True interoperability would allow these different platforms to access services, objects and servers in a platform-independent manner. For example, the Simple Object Access Protocol (SOAP) is a protocol that acts as the glue between heterogeneous software components. It offers a mechanism for bridging competing technologies in a standard way. The main goal of SOAP is to facilitate interoperability. However, the increase in interoperability may lead to even easier spoofing and misappropriation of partners' identities in network transactions.
In response to these types of problems, many entities such as vendors and banks have instituted security procedures. For example, the HyperText Transfer Protocol (HTTP) has authentication measures such as the secure socket layer (SSL) which can be used by most web browsers to employ a key to encrypt and decrypt information transmitted over the Internet (or any Network) between partners in a secure transaction. Other examples include the use of symmetric keys, asymmetric keys, session keys, tokens or other types of security credentials.
An initiating partner sends its security credentials to a receiving partner. The receiving partner then checks any incoming messages with the security credentials to ensure that each message it receives from the sending partner has credentials that match. Credentials may include a certificate, a token or a signature. Currently, these credentials are implemented and verified in software. This is not very efficient and may still be subjected to manipulation. For example, keys stored in a file system are typically managed by software applications. During the processing of the software application, the keys may be exposed. Similarly, if the keys are stored in a database, they may be exposed after they are stored.